A child forge's disk, memory, CPU and process limits are enforced by the kernel; a 50G fallocate on a small child must fail #10850

A child forge's limits are enforced by the kernel, not by a watch.

scottishbob, testing his hosted child forge, ran fallocate -l 50G bigfile from a shell on it. It worked: the file was 51G, and the shared disk under the forge pod went from 355G to 314G free. He deleted it afterwards.

src/spawn/sizes.ts says a small child gets diskMiB: 2048, but nothing enforces that. Memory is checked by a once-a-second watch (#10518), and the shell's prompt shows the parent pod's hostname (forge-5db854487b-…). The owner: "I want to make sure we have the proper defenses."

Done when, each enforced by the kernel and each with a test that tries to break it:

1. Disk. Every child's writable space (its data dir, crew work trees, machines and shells, app data, and /tmp) lives on a per-child filesystem with a hard size: an ext4 or xfs image or a project quota, sized from sizes.ts. fallocate/dd past the size fails with ENOSPC inside the child, and the parent's free space doesn't move. Inode limits are covered too.
2. Memory and processes. The cgroup delegation in #10518: memory.max, memory.swap.max=0 and pids.max per cell. A fork bomb or a memory hog inside a child is killed inside its cell, and the parent forge's own health probes stay green during the test.
3. CPU. cpu.max per cell (it exists; verify it holds under 64 cores), plus an io.max/io weight so one child can't saturate the disk for everyone.
4. Open files and sockets. RLIMIT_NOFILE and RLIMIT_NPROC are set inside the cell.
5. The parent protects itself. If the pod's disk falls below 15% free, children go read-only and no new child or cell starts. The owner gets one line on the ops page and one notification.
6. Its own hostname. A cell shows its child's name, never the parent pod's (the UTS namespace is already unshared, so set the hostname inside it).
7. Visible. The child's own forge shows its limits and usage in one line each (disk, memory, CPU), so a person knows the box they're in. The parent's machines page shows each child's usage against its size.

The first priority is (1) disk, which is live and open now. A single person on a small forge can still fill the shared disk.